CVE-2023-45808

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-458092.7Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin c CVE-2023-45814.3Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any w CVE-2023-458107.5OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are CVE-2023-458117.8Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Succ CVE-2023-458127.5The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation CVE-2023-458137.5Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the CVE-2023-458145.3Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, CVE-2023-458155.4ArchiveBox is an open source self-hosted web archiving system. Any users who are using the `wget` extractor and view the content it outputs.CVE-2023-458163.3Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the CVE-2023-458186.1TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and r CVE-2023-458196.1TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API.CVE-2023-45828.8Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much pr